Heckel, Hank (MYR) 


From: 

Sent: 

To: 

Subject: 


72902-46637773@requests.muckrock.com 
Wednesday, May 08, 2019 2:09 PM 
MayorSunshineRequests, MYR (MYR) 

California Public Records Act Request: April 28-May 4, 2019 Calendar - Immediate 
Disclosure Request 


This message is from outside the City email system. Do not open links or attachments from untrusted sources. 


May 8, 2019 


This is an Immediate Disclosure Request under the San Francisco Sunshine Ordinance, made before close of 
business May 8, 2019. 

** Note that all of your responses (including disclosed records) may be automatically and instantly available to 
the public on the MuckRock.com service used to issue this request (though I am not a MuckRock 
representative). ** 

We request under the San Francisco Sunshine Ordinance (Ordinance) and the California Public Records Act 
(CPRA): 

"1. an electronic copy, in the original electronic format, with all calendar item headers, email addresses, 
metadata, timestamps, attachments, appendices, exhibits, and inline images, except those explicitly exempted by 
the Ordinance, of the Mayor's calendar, with all items, from April 28 to May 4, 2019 (inclusive)." 

We remind you of your obligations to provide electronic records in the original format you hold them in. 
Therefore, calendars exported in the .ics, iCalendar, or vCard formats with all non-exempt headers, metadata, 
attachments, etc. are best. Such formats are easily exportable from Google Calendar, Microsoft Outlook, 
Microsoft Exchange or other common calendaring/email systems. 

However, if you choose to convert calendar items, for example, to PDF or printed format, to easily redact them, 
you must ensure that you have preserved the full content of the original calendar item record (as specified in 
request "1"), which contains many detailed headers beyond the ones generally printed out. If you instead 
provide PDFs or printed items with only a few of the headers or lacking attachments/images, and therefore 
withhold the other headers/attachments without justification, you may be in violation of SF Admin Code 67.26, 
67.27, Govt Code 6253(a), 6253.9, and/or 6255, and we may challenge your decision. 

Please provide only those copies of records available without any fees. If you determine certain records would 
require fees, please instead provide the required notice of which of those records are available and non-exempt 
for inspection in-person if we so choose. 

I look forward to your immediate disclosure. 


Sincerely, 

Anonymous 


l 



Filed via MuckRock.com 

E-mail (Preferred): 72902-46637773@requests.muckrock.com 
Upload documents directly: 

https ://accounts.muc krock.com/accounts/lo gin/?ncxt=https%3A%2F%2F www. muckrock. com %2Faccounts%2 
Flogin%2F%3Fnext%3D%252Faccounts%252Fagency_login%252Foffice-of-tbe-mayor-3891%252Fapril-28- 
may-4-2019-calendar-immediate-disclosure-request- 

72902%252F%253Femail%253Dmayorsunshinerequests%252540sfgov,org&url_auth_token=AAAxJIlHlMv5 

WCJDSHoGRqLEvZI%3AlhOToC%3AZxoqEQlu6tRbOKZAtaUyEN5NsAQ 

Is this email coming to the wrong contact? Something else wrong? Use the above link to let us know. 

For mailed responses, please address (see note); 

MuckRock News 
DEPT MR 72902 
411A Highland Ave 
Somerville, MA 02144-2516 

PLEASE NOTE: This request is not filed by a MuckRock staff member, but is being sent through MuckRock 
by the above in order to better track, share, and manage public records requests. Also note that improperly 
addressed (i.e., with the requester's name rather than "MuckRock News" and the department number) requests 
might be returned as undeliverable. 
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Heckel, Hank (MVR) 


From: 

Sent: 

To: 

Subject: 


MayorSunshineRequests, MYR (MYR) 

Thursday, May 09, 2019 4:13 PM 

72902-46637773@requests.muckrock.com; MayorSunshineRequests, MYR (MYR) 

RE: California Public Records Act Request: April 28-May 4, 2019 Calendar - Immediate 
Disclosure Request 

MuckRock Calendar Request 4-27 - 5-4.pdf 


Attachments: 


VTA ELECTRONIC MAIL 
Requestor: Anonymous 

Email: 72902-46637773@requests.muckrock.com 
May 9, 2019 

Re: Public Records Request received May 8,2019 
To whom it may concern: 

This responds to your Immediate Disclosure Request below. 

Response Dated April 24, 2019 

Thank you for your inquiry. Please see attached the requested information. 

This information has been provided in a PDF format for its ease of transferability and accessibility, consistent 
with Cal. Gov. Code 6253.9(a)(1). Moreover, pursuant to Cal. Gov. Code 6253.9 (t), an agency is not required 
to provide an electronic record in an electronic format that would jeopardize or compromise the security or 
integrity of the original record. The PDF format ensures the security and integrity of the original record. 

Please also note that we are responding on behalf of the Mayor’s Office only, and not on behalf of other city 
departments. 

If you have any questions about your request or would like to submit another public records request, please feel 
free to contact us at mayorsunshinereQuests@sfiJov.org . 

Best Regards, 

Hank Heckel 

Compliance Officer 

Office of Mayor London N. Breed 

City and County of Sail Francisco 


From: 72902-46637773@requests.muckrock.com [mailto:72902-46637773@requests.muckrock.com] 

Sent: Wednesday, May 08, 2019 2:22 PM 

To: MayorSunshineRequests, MYR (MYR) <mayorsunshinerequests@sfgov.org> 

Subject: RE: California Public Records Act Request: Aprii 28-May 4, 2019 Calendar - Immediate Disclosure Request 


l 





This message is from outside the City email system. Do not open links or attachments from untrusted sources. 


May 8,2019 

This is a follow up to a previous request: 

We remind you of your obligation under City of San Jose v Superior Court (2017) to search personal 
accounts/devices for calendar items regarding the public's business, as appropriate. 

** Note that all of your responses (including disclosed records) may be automatically and instantly available to 
the public on the MuckRock.com service used to issue this request (though I am not a MuckRock 
representative). ** 

Filed via MuckRock.com 

E-mail (Preferred): 72902-46637773@reauests.muckrock.com 
Upload documents directly: 

https://accounts .muckrock.com/accounts/login77n ex t=https%3A%2F%2F www. muckrock.com%2Faccounts%2 

Flogin%2F%3Fnext%3D a /o252Faccounts%252Fageiicv_login%252Foffice-of-tbe-mavor-3891%252FaDri]-28- 

mav-4-2019-calendar-immediate-disclosure-request- 

72902%252F%253Femail%253Dmavorsunshinerequests%252540sfgov.org&url auth token=AAAxJHHIMv5 

WCJDSHoGRaLEvZI%3AlhOUOU%3Anmn.EixANiDvfWbvkZ6uZtNUkXgl 

Is this email coming to the wrong contact? Something else wrong? Use the above link to let us know. 

For mailed responses, please address (see note): 

MuckRock News 
DEPT MR 72902 
411A Highland Ave 
Somerville, MA 02144-2516 

PLEASE NOTE: This request is not filed by a MuckRock staff member, but is being sent through MuckRock 
by the above in order to better track, share, and manage public records requests. Also note that improperly 
addressed (i.e., with the requester's name rather than "MuckRock News" and the department number) requests 
might be returned as undcliverable. 


On May 8,2019: 

This is an Immediate Disclosure Request under the San Francisco Sunshine Ordinance, made before close of 
business May 8, 2019. 

** Note that all of your responses (including disclosed records) may be automatically and instantly available to 
the public on the MuckRock.com service used to issue this request (though I am not a MuckRock 
representative). ** 

Wc request under the San Francisco Sunshine Ordinance (Ordinance) and the California Public Records Act 
(CPRA): 
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"1. an electronic copy, in the original electronic format, with all calendar item headers, email addresses, 
metadata, timestamps, attachments, appendices, exhibits, and inline images, except those explicitly exempted by 
the Ordinance, of the Mayor’s calendar, with all items, from April 28 to May 4, 2019 (inclusive)." 

We remind you of your obligations to provide electronic records in the original format you hold them in. 
Therefore, calendars exported in the .ics, iCalendar, or vCard formats with all non-exempt headers, metadata, 
attachments, etc. are best. Such formats are easily exportable from Google Calendar, Microsoft Outlook, 
Microsoft Exchange or other common calendaring/email systems. 

However, if you choose to convert calendar items, for example, to PDF or printed format, to easily redact them, 
you must ensure that you have preserved the full content of the original calendar item record (as specified in 
request "1"), which contains many detailed headers beyond the ones generally printed out. If you instead 
provide PDFs or printed items with only a few of the headers or lacking attachments/images, and therefore 
withhold the other headers/attachments without justification, you may be in violation of SF Admin Code 67.26, 
67.27, Govt Code 6253(a), 6253.9, and/or 6255, and we may challenge your decision. 

Please provide only those copies of records available without any fees. If you determine certain records would 
require fees, please instead provide the required notice of which of those records are available and non-exempt 
for inspection in-person if we so choose. 

I look forward to your immediate disclosure. 

Sincerely, 

Anonymous 

Filed via MuckRock.com 

E-mail (Preferred): 72902-46637773@requests.muckrock.com 
Upload documents directly: 

https://accounts.muckrock.com/accounts/login/?next=https%3A%2F%2Fwww.muckrock..com%2Faccounts%2 

Flogin%2F%3Fnext%3D%252Faccounts%252Fagencv login%252Fo ffic e - o f- til e -m ayo r- 3 8 9 1 %25 2 F ap n [ - 2 8 - 

mav-4-2019-calendar-immediate-disclosure-request- 

72902%252F%253Femail%253Dmavorsunshinerequests%252540sfgov-org&uri auth token=AAAxJIlHIMv5 

WCJDSHoGRaLEvZI%3AlhOUOU%3AnmnEixANiDvfWbvkZ6uZtNUkXgI 

Is this email coming to the wrong contact? Something else wrong? Use the above link to let us know. 

For mailed responses, please address (see note): 

MuckRock News 
DEPT MR 72902 
411A Highland Ave 
Somerville, MA 02144-2516 

PLEASE NOTE: This request is not filed by a MuckRock staff member, but is being sent through MuckRock 
by the above in order to better track, share, and manage public records requests. Also note that improperly 
addressed (i.e., with the requester's name rather than "MuckRock News” and the department number) requests 
might be returned as undeliverable. 
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April 27, 20X9 


8:45 AM - 9:15 AM 

North Beach Farmers Market 2019 Season Open — $99 Columbus Avenue, San Francisco,, CA 94133 

11:55 AM - 1:25 PM 

12th Annual McKinley Elementary School Dogfest -- Duboce Park, Noe Street at Duboce Avenue, San 
Francisco, CA 94114 

7:05 PM - 7:20 PM 

A Banner of Love Gala: A Night in Venice — St. Mary's Cathedral, 1111 Gough St,, San Francisco 

8:40 PM - 9:00 PM 

Ballroom 

Beyond Differences Gala - Terra Gallery, 511 Harrison Street, San Francisco 

April 28, 2019 


7:00 PM - 7:30 PM 

Skyline Blvd, San Francisco, CA 94132 

North Beach Citizens' Spring Dinner - 666 Filbert Street, San Francisco CA 94133 

April 29, 2019 


3:00 AM - 9:30 AM 

Meeting Re: Staff Check In -- Remote Conference Call 

Attendees: 

Mayor's Office Staff 

1:05 PM * 1:30 PM 

Meeting with President Yee Re: District 7 « City Hall, Room 200, Mayor's Office 

Attendees: 

President Yee, Supervisor for District 7, Board of Supervisors 

Jen Lowe, Legislative Aide, Board of Supervisors 

Mayor’s Office Staff 

L:39 PM - 1:46 PM 

Press availability re; MTA Director -- City Hall, Room 200 

L:51 PM - 2:10 PM 

Meeting Re: Scheduling -- City Hall, Room 200, Mayor's Office 

Attendees: 

Mayor’s Office Staff 

!;34 PM - 2:45 PM 

Swearing In Ceremony for Sophie Maxwell and Tim Paulson - City Hall, International Room 

Attendees: 

Sophie Maxwell, Public Utilities Commission Appointee 

Tim Paulson, Public Utilities Commission Appointee 


PropG, Mayor (MYR) 
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April 29, 2019 Continued 



Harlan Kelly Jr., General Manager, San Francisco Public Utilities 
Commission 

Larry Mazzola Jr., President (Plumbers & Pipe Fitters Local 38), 
Recreation and Park Commissioner 

Sandra Duarte, Executive Assistant San Francisco Building and 
Construction Trades Council 

Kim Tavaglione, Campaign Director San Francisco Labor Council 
Willie Adams, Port Commissioner 

Mayor’s Office Staff 

3:01 PM - 3:29 PM 

Meeting Re: Government Affairs — City Hall, Room 200, Mayor's Office 

Attendees: 

Mayor’s Office Staff 

3:31 PM - 4:03 PM 

Meeting Re: City Operations and Government Affairs — City Hall, Room 200, Mayor's Office 

Attendees: 

Mayor’s Office Staff 

4:10 PM -4:55 PM 

Meeting Re: Housing Bond with Supervisor Yee and Members of Housing Bond Working Group — City 

Hall, Room 201 

6:00 PM - 6:30 PM 

Grace Cathedral Paris Sister City Event for Notre-Dame, Sri Lanka, Louisiana Churches, and Poway 
Synagogue — Grace Cathedral, 1100 California Street 

6:45 PM - 8:00 PM 

Recode Decode Podcast Live Recording — Manny's 3092 16th Street 

April 30, 2019 


9:00 AM - 9:30 AM 

Meeting Re: Staff Check In — Remote Conference Call 

Attendees: 

Mayor's Office Staff 

10:3S AM - 10:50 AM 

Public Works Week Awards and Pins Ceremony — Moscone Center South, Third Floor, 747 Howard St, 

12:00 PM -12:30 PM 

Telephone Interview with LA Times Reporter Heidi Chang — Remote Conference Call 

Attendees: 

Heidi Chang, Reporter, Los Angeles Times 

Mayor’s Office Staff 

12:35 PM - 1:15 PM 

Meeting Re: Budget — City Hall, ROom 200, Mayor 1 s Office 

Attendees: 

Mayor’s Office Staff 


PropG, Mayor (MYR) 
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April 30, 2019 Continued 


1:34 PM - 1:50 PM 

Meeting Re: Town Hall Event -- City Hall, Room 200, Mayor's Office 

Attendees: 

Mayor’s Office Staff 

2:09 PM - 2:45 PM 

Meeting with San Francisco Latino Parity and Equity Coalition - City Hall, Room 201 

2:46 PM-3:10 PM 

Meeting Re: Scheduling -- City Hall, Room 200, Mayor s Office 

Attendees: 

Mayor’s Office Staff 

3:10 PM - 3:33 PM 

Meeting Re: Government Affairs - City Hall, Room 200, Mayor's Office 

Attendees: 

Mayor’s Office Staff 

May 1, 2019 


9:00 AM-9:30 AM 

Meeting Re: Staff Check In - Remote Conference Call 

Attendees: 

Mayor’s Office Staff 

10:00 AM - 10:30 AM 

Live Phone Interview with KIQI -- Remote Conference Call 

Attendees: 

Isabel Gutierrez, KIQI radio host 

Marcos Gutierrez, KIQI radio host 

Mayor’s Office Staff 

11:00 AM - 11:30 AM 

Fire Station 5 Ribbon Cutting — Fire Station No. 5, 1301 Turk St 

12:00 PM - 12:15 PM 

Jewish Vocational Service Strictly Business Luncheon — San Francisco Marriott Marquis Hotel, 780 Mission 
Street 

2:04 PM - 2:43 PM 

Meeting Re: City Services and Operations - City Hail, Room 200, Mayor 1 s Office 

Attendees: 

Naomi Kelly, City Administrator, City and County of San Francisco 
Heather Green, Capital Planning Director, City and County of San 
Francisco 

Mayor’s Office Staff 

2:43 PM - 2:46 PM 

Swearing In Ceremony for Frank Fung — City Hall, Room 200, Mayor's Office 

Attendees: 

Frank Fung, Planning Commissioner 

Aimee Fung, Daughter of Frank Fung 

Mayor’s Office Staff 


PropG, Mayor (MYR) 
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Meeting Re; City Services and Operations -- City Hall, Room 200, Mayor's Office 

Attendees: 

Naomi Kelly, City Administrator, City and County of San Francisco 
Heather Green, Capital Planning Director, City and County of San 
Francisco 

Mayor’s Office Staff 

Meet and Greet with Jamestown Community Center Youth -- City Hall. International Room 


Meeting Re: Public Safety - City Hall, Room 200 Mayor s Office 
Attendees: 

• Chief William Scott, SFPD 

• Deirdre Hussey, Director of Policy and Public Affairs, SFPD 

• Mayor’s Office Staff 


Neighborhood Preference Program Tour and SFGovTV Interview — 150 Van Ness 

Attendees: 

Mario Watts, resident 
Josiah Watts, resident 

Kim Dubin, Mayor’s Office of Community Housing and Development 
Max Barnes, Mayor’s Office of Community Housing and Development 
Mayor’s Office Staff 

Asian Pacific American Heritage Month Awards and Reception Celebration — Herbst Theater, War 
Memorial Building, 401 Van Ness Avenue 


May 2, 2019 


9:00 AM - 9:30 AM 


12:04 PM - 12:25 PM 


12:31 PM * 12:48 PM 


PropG, Mayor (MYR) 


Meeting Re: Staff Check In Remote Conference Call 

Attendees: 

Mayor’s Office Staff 

Lest We Forget Photo Exhibit for Holocaust Remembrance Day -- City Hall. Room 200, Mayor's Office 


Meeting re: Street Conditions — City Hall. Room 200, Mayor's Office 

Attendees: 

Chief William Scott, Chief of Police, San Francisco Police 
Department 

Dr. Grant Colfax, Director, Department of Public Health 
Mohammed Nuru, Director, Department of Public Works 
Jeff Kositky, Director, Department of Homelessness and Supportive 
Housing 

Mary Ellen Carrol, Director, Department of Emergency Management 
Mayor’s Office Staff 


2:46 PM - 3:13 PM 


3:20 PM - 3:46 PM 


4:03 PM - 4:35 PM 


5:00 PM - 5:20 PM 


5:30 PM - 6:00 PM 


5/8/2019 2:49 PM 







May 2, 2019 Continued 


1:31 PM - 2:11 PM 

Meeting Re: Budget -- City Hail, Room 200, Mayor's Office 

Attendees: 

Mayor’s Office Staff 

2:14 PM - 2:34 PM 

Meeting Re: Communications — City Hall, Room 200, Mayor's Office 

Attendees: 

Mayor’s Office Staff 

2:34 PM - 3:07 PM 

Meeting Re: Commissions — City Hall, Room 200, MO 

Attendees: 

Mayor's Office Staff 


3:10 PM * 3:41 PM 

Meeting with Civil Grand Jury — City Hall, Room 201 

3:42 PM - 3:49 PM 

Meeting Re: Government Affairs -- City Hall, Room 200, Mayor s Office 

Attendees: 

Kylecia Broom, Community Development Assistant, Mayor’s Office 
of Housing and Community Development 

Steven Gallardo, Displaced Tenant Housing Preference Program 
Coordinator, Mayor’s Office of Housing and Community Development 
Mayor’s Office Staff 

5:30 PM - 6:00 PM 

Alliance of Black School Educators Scholarship and Salute Banquet - African American Art and Culture 
Complex, 762 Fulton Street, 3rd Floor 

May 3, 2019 


9:00 AM - 9:30 AM 

Meeting Re: Staff Checkin — Remote Conference Call 

Attendees: 

Mayor’s Office Staff 

1:00 PM - 1:30 PM 

Downtown Streets Team Mission Ribbon Cutting — 3100 17th Street, San Francisco 

May 4, 2019 



PropG, Mayor (MYR) 
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May 4, 2019 Continued 


6:10 PM - 6:40 PM 


The 


Association of Chinese Teachers 50th Anniversary Gala - Scottish Rite Masomc Center, 2850 19th 


Avenue 


PropG, Mayor (MYR) 
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A Cyberattack Hobbles Atlanta, and Security Experts Shudder - The New York Times 

U-S- I A Cyberattack Hobbles Atlanta, and Security Experts Shudder 

(&[)£ iNcVu Ijork Siitics 

A Cyberattack Hobbles Atlanta , 
and Security Experts Shudder 

By Alan Blinder and Nicole Perlroth 

March 27, 2018 

ATLANTA — The City of Atlanta’s 8,000 employees got the word on Tuesday that they had 
been waiting for: It was O.K. to turn their computers on. 

But as the city government’s desktops, hard drives and printers flickered back to life for 
the first time in five days, residents still could not pay their traffic tickets or water bills 
online, or report potholes or graffiti on a city website. Travelers at the world’s busiest 
airport still could not use the free Wi-Fi. 

Atlanta’s municipal government has been brought to its knees since Thursday morning by 
a ransomware attack — one of the most sustained and consequential cyberattacks ever 
mounted against a major American city. 

The digital extortion aimed at Atlanta, which security experts have linked to a shadowy 
hacking crew known for its careful selection of targets, laid bare once again the 
vulnerabilities of governments as they rely on computer networks for day-to-day 
operations. In a ransomware attack, malicious software cripples a victim’s computer or 
network and blocks access to important data until a ransom is paid to unlock it. 

“We are dealing with a hostage situation,” Mayor Keisha Lance Bottoms said this week. 

The assault on Atlanta, the core of a metropolitan area of about six million people, 
represented a serious escalation from other recent cyberattacks on American cities, like 
one last year in Dallas where hackers gained the ability to set off tornado sirens in the 
middle of the night. 


https://www.nyttmes.com/2018/03/27/us/cyberattack-atlanta-ransomware.html 
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A Cyberattack Hobbles Atlanta, and Security Experts Shudder - The New York Times Page 2 of 5 

Part of what makes thg behind lt: A 

that locks up its victims’ files with encryption, temporarily changes their file names to I m 
sorry" and gives the victims a week to pay up before the files are made permanently 
inaccessible. 


You have 3 free articles remaining. 
Subscribe to The Times 


Threat researchers at Dell Secure Works, the Atlanta-based security firm helping the city 
respond to the ransomware attack, identified the assailants as the SamSam hacking crew, 
one of the more prevalent and meticulous of the dozens of active ransomware attack 
groups. The SamSam group is known for choosing targets that are the most likely to 
accede to its high ransom demands — typically the Bitcoin equivalent of about $50,000 — 
and for finding and locking up the victims’ most valuable data. 

In Atlanta, where officials said the ransom demand amounted to about $51,000, the group 
left parts of the city’s network tied in knots. Some major systems were not affected, 
including those for 911 calls and control of wastewater treatment. But other arms of city 
government have been scrambled for days. 

The Atlanta Municipal Court has been unable to validate warrants. Police officers have 
been writing reports by hand. The city has stopped taking employment applications. 

Atlanta officials have disclosed few details about the episode or how it happened. They 
have urged vigilance and tried to reassure employees and residents that their personal 
information was not believed to have been compromised. 

Dell Secure Works and Cisco Security, which are still working to restore the city’s systems, 
declined to comment on the attacks, citing client confidentiality. 

Ms. Bottoms, the mayor, has not said whether the city would pay the ransom. 

The SamSam group has been one of the more successful ransomware rings, experts said. It 
is believed to have extorted more than $1 million from some 30 target organizations in 2018 

alone. 


https://www.nytimes.com/2018/03/27/us/cybcrattack-atianta-ransomware.html 
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It is not ideal to pay that ^ can more 

easily afford the $50,000 or so in ransom than the time and cost of restoring their locked 
data and compromised systems. In the past year, the group has taken to attacking 
hospitals, police departments and universities — targets with money but without the 
luxury of going off-line for days or weeks for restoration work. 


Investigators are not certain who the SamSam hackers are. Judging from the poor English 
in the group's ransom notes, security researchers believe they are probably not native 
English speakers. But they cannot say for sure whether SamSam is a single group of 
cybercriminals or a loose hacking collective. 


Ransomware emerged in Eastern Europe in 2009, when cybercriminals started using 
malicious code to lock up unsuspecting users’ machines and then demanding 100 euros or 
similar sums to unlock them again. Over the past decade, dozens of online cybercriminal 
outfits — and even some nation states, including North Korea and Russia have taken up 
similar tactics on a larger scale, inflicting digital paralysis on victims and demanding 
increasing amounts of money. 


Cybersecurity experts estimate that criminals made more than $1 billion from ransomware 
in 2016, according to the F.B.I. Then, last May, came the largest ransomware assault 
recorded so far: North Korean hackers went after tens of thousands of victims in more 
than 70 countries around the world, forcing Britain’s public health system to reject 
patients, paralyzing computers at Russia’s Interior Ministry, at FedEx in the United 
States, and at shipping lines and telecommunications companies across Europe. 

A month later, Russian state hackers deployed similar ransomware to paralyze computers 
in Ukraine on the eve of the country’s independence day. That attack shut down automated 
teller machines in Kiev, froze government agencies and even forced workers at the 
Chernobyl nuclear power plant to monitor radiation levels manually. Collateral damage 
from that attack affected computers at Maersk, the Danish shipping conglomerate; at 
Merck, the American-based pharmaceutical giant; and even at businesses in Russia. 


Attempted ransomware attacks against local governments in the United States have 
become unnervingly common. A 2016 survey of chief information officers for jurisdictions 
across the country found that obtaining ransom was the most common purpose of 
cyberattacks on a city or county government, accounting for nearly one-third of all attacks. 


https://www.nytimes.com/2018/03/27/us/cyberattack-atlanta-ransomware.html 
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The survey, conducted Jyj X?® [ Associat ^ n the 

University of Maryland, Baltimore County, also found that about one-quarter of local 
governments reported that they were experiencing attacks of one kind or another, 
successful or not, at least as often as once an hour. 


Yet less than half of the local governments surveyed said they had developed a formal 
cybersecurity policy, and only 34 percent said they had a written strategy to recover from 

breaches. 


Experts said government officials needed to be more aggressive about preventive 
measures, like training employees to spot and sidestep “phishing” attempts meant to trick 
them into opening the digital door for ransomware. 

“It’s going to be even more important that local governments look for the no-cost/low-cost, 
but start considering cybersecurity on the same level as public safety,” said David Jordan, 
the chief information security officer for Arlington County, Va. “A smart local government 
will have fire, police and cybersecurity at the same level.” 

Ms. Bottoms, who took office as mayor of Atlanta in January, acknowledged that shoring 
up the city’s digital defenses had not been a high priority before, but that now “it certainly 
has gone to the front of the line.” 

“As elected officials, it’s often quite easy for us to focus on the things that people see, 
because at the end of the day, our residents are our customers,” Ms. Bottoms said. “But we 
have to really make sure that we continue to focus on the things that people can t see, and 
digital infrastructure is very important.” 

During the ransomware attack, local leaders have sometimes been able to do little but 
chuckle at a predicament that was forcing the city to turn the clock back decades. 

Asked on Monday how long the city might be able to get by doing its business strictly with 
ink and paper, Ms. Bottoms replied: “It was a sustainable model until we got computer 
systems. It worked for many years. And for some of our younger employees, it will be a 
nice exercise in good penmanship.” 

Security researchers trying to combat ransomware have noticed a pattern in SamSam s 
attacks this year: Some of the biggest have occurred around the 20th of the month. 


https://www.nytimes.com/2018/03/27/us/cyberattack-atlaiita-ransomware.html 
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Allan Liska, a senior been trac |^ §thc 

group, saiu in an interview that he believed that SamSam gains access to its victimo 

systems and then waits for weeks before encrypting the victims’ data. That delay, Mr. 
Liska said, makes it harder for responders to figure out how the group was able to break in 
— and easier for SamSam’s hackers to strike twice. 


The Colorado Department of Transportation was able to restore its systems on its own 
after a SamSam attack, without paying SamSam a dime. But a week later, the hackers 
struck the department again, with new, more potent ransomware. 

“They are constantly learning from their mistakes, modifying their code and then 
launching the next round of attacks,” Mr. Liska said. 


Alan Blinder reported from Atlanta, and Nicole Perlroth from Boulder, Colo. 

A version of this article appears in print on March 27, 2018, on Page A14 of the New York edition with the headline: Atlanta Hobbled by Major 
Cyberattack That Mayor Calls 'a Hostage Situation' 
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8 clays after cyberattack, Baltimore’s network still hobbled 


By David McFadden | AP 
May 15 at 7:38 PM 

BALTIMORE — More than a week after a cyberattack hobbled Baltimore’s computer network, city officials 
said Wednesday they can’t predict when its overall system will be up and running and continued to give only 
the broadest outlines of the problem. 

Baltimore’s government rushed to take down most computer servers on May 7 after its network was hit by 
ransomware. Functions like 911 and EMS dispatch systems weren’t affected, officials say, but after eight days, 
online payments, billing systems and email are still down. Finance department employees can only accept 
checks or money orders. 

No property transactions have been conducted since the attack, exasperating home sellers and real estate 
professionals in the city of over 600 , 000 . Most major title insurance companies have even prohibited their 
agents from issuing policies for properties in Baltimore, according to the Greater Baltimore Board of 
Realtors. 

Citing an ongoing criminal investigation, Baltimore’s information technology boss Frank Johnson and other 
city leaders said Wednesday they could provide no specifics about the attack from the ransomware variant 
RobbinHood or realistically forecast when the various hobbled layers of the city’s network would be back up. 

“Anybody that’s in this business will tell you that as you learn more those plans change by the minute. They 
are incredibly fluid,” said Johnson, stressing that city employees, expert consultants and others were working 
“round the clock” to mend the breached network. 

The FBI’s cyber squad agents have been helping employees in Maryland’s biggest city try to determine the 
source and extent of the latest attack. 

Johnson’s tenure has now included two major breaches to the city’s computer systems. This month s 
problems come just over a year since another ransomware attack slammed Baltimore’s 911 dispatch system, 
prompting a worrisome 17 -hour shutdown of automated emergency dispatching. The March 2018 attack 
required operating the critical 911 service in manual mode. 

Johnson is one of the city’s highest paid employees, earning $ 250,000 a year. That’s more than the mayor, 
the city’s top prosecutor and the health commissioner are paid. This latest attack came about a week after the 
firing of a city employee who, the inspector general said, had downloaded thousands of sexually explicit 
images onto his work computer during working hours. 

While all municipalities are menaced by malware, cyber security experts say organizations that fall victim to 
such attacks often haven’t done a thorough job of patching systems regularly. 
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Asher DeMetz, lead security consultant for technology company Sungard Availability Services, suggested that 
eight days was a long time for a network to remain down. 

“The City of Baltimore should have been prepared with a recovery strategy and been able to recover within 
much less time. That time would be dictated by a risk assessment guiding how long they can afford to be 
down,” DeMetz said in an email. “They should have been ready, especially after the previous attack, to recover 

from ransomware.” 

City Solicitor Andre Davis said Baltimore was working “hand in glove” with the FBI, Microsoft officials, and 
expert contractors that he and other officials declined to identify. Before TV news crews, Davis likened the 
cyberattack to a brutal assault, a comparison that many residents can clearly understand in a city struggling 
to bring down on 6 of urban America’s highest rates of violent crime* 

“My preferred way of thinking about it is; The city network was viciously assaulted by a culprit and seriously 
injured,” Davis said. Baltimore’s top lawyer portrayed the city network as an injured patient who has emerged 
from the ICU and faces a “long course of physical therapy.” 

Baltimore authorities, who hope to prosecute the culprit behind the latest attack, said they were in close 
contact with counterparts in Atlanta. Last year, a ransomware attack significantly disrupted city operations 
there and caused millions of dollars in losses. In December, two Iranian men already indicted in New Jersey 
in connection with a broad cybercrime and extortion scheme were indicted on federal charges in Georgia 
related to that ransomware attack demanding payment for a decryption key. 

It’s not clear what culprits are demanding from Baltimore’s City Hall. 

“We’re not going to address or discuss in any way the ransom demand,” Davis said. 


Follow McFadden on Twitter: https://twitter.com/dmcfadd 

Copyright 2019 The Associated Press. All rights reserved. This material may not be published, broadcast, 
rewritten or redistributed. 
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